Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

DOS: Lack of Array Length Check in enrootDeposits Function

lordofterra

Summary

There is no explicit check on the length of the stems and amounts input arrays. This omission allows users to call the function with arrays of arbitrary length.

function enrootDeposits(
address token,
int96[] calldata stems,
uint256[] calldata amounts
) external payable nonReentrant mowSender(token) {
require(s.u[token].underlyingToken != address(0), "Silo: token not unripe");
// First, remove Deposits because every deposit is in a different season,
// we need to get the total Stalk, not just BDV.
LibSilo.AssetsRemoved memory ar = LibSilo._removeDepositsFromAccount(msg.sender, token, stems, amounts);
​
// Get enroot data.
EnrootData memory enrootData = _getTokenEnrootData(token, ar);
​
// Iterate through all stems, redeposit the tokens with new BDV and
// summate new Stalk.
for (uint256 i; i < stems.length; ++i) {
​
uint256 depositBdv;
if (i+1 == stems.length) {
// Ensure that a rounding error does not occur by using the
// remainder BDV for the last Deposit
depositBdv = enrootData.newTotalBdv.sub(enrootData.bdvAdded);
} else {
// depositBdv is a proportional amount of the total bdv.
// Cheaper than calling the BDV function multiple times.
depositBdv = amounts[i].mul(enrootData.newTotalBdv).div(
enrootData.totalAmountRemoved
);
}
​
enrootData.stalkAdded = enrootData.stalkAdded.add(
addDepositAndCalculateStalk(
token,
stems[i],
amounts[i],
depositBdv,
enrootData.stemTip,
enrootData.stalkPerBdv
)
);
​
enrootData.bdvAdded = enrootData.bdvAdded.add(depositBdv);
}
​
// increment bdv and mint stalk.
// bdv and stalk from enrooting does not germinate
// given that the assets are unripe.
// reverts if bdvAdded < bdvRemoved.
LibTokenSilo.incrementTotalDepositedBdv(
token,
enrootData.bdvAdded.sub(
ar.active.bdv
.add(ar.even.bdv)
.add(ar.odd.bdv)
)
);
LibSilo.mintActiveStalk(
msg.sender,
enrootData.stalkAdded.sub(
ar.active.stalk
.add(ar.even.stalk)
.add(ar.odd.stalk)
.add(ar.grownStalkFromGermDeposits)
)
);
}
​

Impact

  1. Attackers could pass extremely large arrays to the function, potentially causing legitimate transactions to fail due to block gas limit exhaustion.

  2. By exploiting the lack of array length checks, an attacker could create conditions where the function consistently runs out of gas, rendering it unusable.

Tools Used

Manual review

Recommendations

  1. Implement a check to enforce a maximum array length, ensuring that the function cannot be called with arrays that exceed this limit.

  2. Define a constant that represents the maximum allowable length for input arrays and reference this constant in the length check.

Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.